Network system and vehicle

Abstract

The invention relates to a network system comprising at least two network devices and, for each network device, at least one communicating device connected to one of the network devices, and a respective network device connected to at least one further network device to enable the exchange of data packets between communicating devices via the network devices, wherein the respective network devices have an integrated firewall functionality for filtering forwarded data packets, further comprising a firewall allocation unit configured to monitor the network devices and, depending on a monitoring result for data packets to be transmitted from a source device to a destination device, to determine one of the network devices for filtering the data packets.The network system is characterized in that the firewall allocation unit is further configured to determine a processing requirement for the data packets issued by the source device, to determine a network device-specific processing capability for the network devices integrated in the direct network path from the source device to the destination device by monitoring the network devices, to compare the processing requirement with the processing capabilities, and to determine such a network device for filtering the data packets whose processing capabilities fulfill the processing requirement.

Description

[0001] The invention relates to a network system according to the type defined in the preamble of claim 1 and to a vehicle comprising such a network system.

[0002] The proportion of electronics in vehicles is constantly increasing, particularly due to increased performance and simultaneous miniaturization. The computing units installed in vehicles can vary in complexity. Outputting control signals for actuators or reading and processing sensor values, for example, is possible using microcontrollers. Microcontrollers are often also referred to as systems-on-a-chip. For more complex tasks, particularly in connection with automated or even autonomous driving, it is necessary to integrate powerful hardware into vehicles. The tasks of multiple control units can also be performed by a central on-board computer.

[0003] The vehicle's electronic components may rely on data exchange with each other. For this purpose, the electronic components are communicatively connected via appropriate data lines. These data lines can be based on a wide variety of technologies and communication protocols. A large portion of the communication takes place via dedicated bus systems such as a CAN bus or Ethernet.

[0004] Information technology systems are always exposed to the risk of compromise. Therefore, information technology systems must be protected from attacks through appropriate security measures. To this end, well-known and proven measures from information technology can be transferred to vehicles, such as the use of firewalls, attack detection and defense systems, cryptographic encryption technologies, and the like.

[0005] To establish an Ethernet network, communicating computing units are connected via network devices. There are various types of network devices, such as repeater hubs, switches, routers, and the like. While a repeater hub distributes data packets to be transmitted to all network ports, a switch, on the other hand, is capable of examining a data packet, determining a destination address specified in the data packet, and forwarding the corresponding data packet only via the network port to which the actual destination device is connected.

[0006] It is common practice to integrate firewalls into switches. A firewall filters the data packets that make up network traffic based on predefined rules. This filtering increases the latency of data forwarding. Network systems can be arbitrarily complex. Especially when data packets have to be forwarded consecutively across multiple switches to reach a specific destination device, each switch rechecks the corresponding data packets, which further increases latency but is also unnecessary.

[0007] US 2015 / 0326532 A1 discloses a method and device for providing a distributed firewall in a network. The document describes a plurality of computing nodes connected to form a network. Firewall instances are executed on some of the computing nodes to filter data packets sent over the network. The individual firewall instances executed on the computing nodes can interact as a large firewall. Data packets sent over the network are forwarded to corresponding computing nodes so that the respective firewall instances can filter the data packets. In this case, it can happen that individual computing nodes are allocated a very large amount of data, creating a bottleneck in the data line. Data packets discarded by firewall filtering are then unnecessarily transmitted through the network, thus wasting computing resources.To avoid these problems, the network includes a firewall controller. The firewall controller can instantiate new firewalls on the network's compute nodes, making more computing capacity available to provide firewall functionality. Data packets can be redirected to these compute nodes accordingly, thus avoiding bottlenecks in the data line.

[0008] Furthermore, DE 10 2016 222 740 A1 discloses a method for a communication network in a vehicle and an electronic control unit. The communication network comprises several communication participants, such as Ethernet switches, control units, and the like. Several of the communication participants have firewall functionality. To relieve the load on individual communication participants, several communication participants cooperate to provide the firewall functionality. Thus, a first part of the data transmission is filtered by a first communication participant, and a second part of the data transmission is filtered by another communication participant.

[0009] In addition, DE 699 34 871 T2 discloses a method and system for the optimal selection of a web firewall in a TCP / IP-based network.

[0010] The present invention is based on the object of providing an improved network system which operates more efficiently.

[0011] According to the invention, this object is achieved by a network system having the features of claim 1. Advantageous embodiments and further developments as well as a vehicle comprising such a network system emerge from the dependent claims.

[0012] A generic network system comprising at least two network devices and at least one communicating device for each network device, wherein the communicating devices are each connected to one of the network devices and a respective network device is connected to at least one further network device in order to enable an indirect exchange of data packets between communicating devices via the network devices, wherein the respective network devices have an integrated firewall functionality for filtering data packets to be forwarded, further comprising a firewall allocation unit, wherein the firewall allocation unit is configured to monitor the network devices and, depending on a monitoring result for data packets to be transmitted from a source device to a destination device, to determine one of the network devices for filtering the data packets, is further developed according to the invention in thatthat the firewall allocation unit is further configured to determine a processing requirement for the data packets output by the source device, to determine a network device-specific processing capability by monitoring the network devices for the network devices integrated in the direct network path from the source device to the destination device, to compare the processing requirement with the processing capabilities, and to determine such a network device for filtering the data packets whose processing capabilities meet the processing requirement.

[0013] The network system according to the invention prevents data packets from being repeatedly filtered by the firewalls of the respective network devices on their way from the source device to the destination device. Thus, the data packets are only filtered by the firewall of a single network device. This reduces the latency in data forwarding and saves computing resources of the network devices, which can then be used to perform additional tasks. As a result, the network system according to the invention operates more efficiently than prior art solutions.

[0014] The network system can have any topology. The network devices can be arranged in a ring, mesh, star, line, tree, bus, or fully connected configuration.

[0015] To provide firewall functionality, the respective network devices can utilize existing hardware resources for forwarding data packets, or they can utilize dedicated hardware components exclusively for providing firewall functionality. For example, existing or separately provided computer-readable storage media can be provided, which contain code modules that allow the provision of firewall functionality through execution by an existing processor or a separately provided processor.

[0016] The firewall allocation unit can also be a network device. However, it can also be a more complex computer system, such as a desktop computer, a server, or a server cluster.

[0017] Data packets are also known as frames. A data packet can consist of multiple sections. For example, a first section can contain the destination address of the destination device, and a second section can contain the source address of the source device. Further sections can contain, for example, a data type, payload, and a checksum. To determine the processing requirements, the firewall allocation unit can read in corresponding data packets and examine the individual sections. Depending on the content, different processing requirements are determined. For example, so-called lookup tables can be implemented in the firewall allocation unit. These tables describe which processing requirements should be selected for which content of the respective sections of the data packet.The processing requirement can also be determined depending on the size of the data packet, i.e. depending on the amount of user data it contains.

[0018] The network device designated for filtering data packets is located in the direct network path from the source device to the destination device. This increases the efficiency of the network system according to the invention, as it eliminates the need to forward the data packets, i.e., route them, to network devices outside the direct network path, which would represent a detour and thus lead to increased latency.

[0019] If several network devices meet the processing requirement, the firewall allocation unit selects the network device to filter the data packets that “best” meets the processing requirement, which will be discussed in more detail below.

[0020] An advantageous development of the network system according to the invention provides that the firewall assignment unit is further configured to configure the firewall functionalities of the network devices integrated in the direct network path from the source device to the target device by assigning rule sets as follows: - Activating a filter logic of the firewall functionality of the network device intended to filter the data packets; and - Deactivate the filter logic of the firewall functionalities of the other network devices.

[0021] This allows for particularly efficient control of the firewall functionalities. Firewall functionalities continue to run on the individual network devices. This means that firewalls do not need to be explicitly instantiated, initialized, started, or anything similar. Furthermore, firewalls or the corresponding virtual machines on which the firewalls run do not need to be terminated, deactivated, or stopped. This simply adapts the filter logic of the respective firewalls to the data packets currently being transmitted. The filter logic of the network device that is supposed to filter the data packets is adapted so that the data packets are processed by the firewall.For example, the filter logic can be adjusted so that a unique identifier of the source device, such as the MAC address, is added to a so-called blacklist, also known as a negative list, so that all data packets from the source device are filtered. Additional filter logic can also be implemented, for example, allowing some of the data packets from the source device to pass through and others to be discarded. Conversely, the firewalls of the other network devices in the direct network path are adjusted accordingly. For example, the MAC address of the source device can be added to a so-called whitelist, also known as a positive list, so that the data packets are not filtered again on the other network devices.

[0022] The transmission of firewall configuration files or rule sets is particularly fast and requires only low network throughput, i.e., a low data transfer rate. Since no firewalls or virtual machines need to be started or shut down, the associated time expenditure is eliminated. This further increases the efficiency of the network system according to the invention.

[0023] According to a further advantageous embodiment of the network system according to the invention, the processing requirement and the respective processing capabilities comprise a risk level, required hardware resources and / or required CPU performance. Depending on the content of a respective data packet to be transmitted over the network, a different risk level may exist, different hardware resources may be required and / or different CPU performance may be required. The risk level depends, for example, on the content of the payload data. If the payload data is merely information, for example the status of a sensor or a vehicle component, a low risk can be assigned. However, if it is control signals, for example for controlling an actuator, a comparatively higher risk level can be selected.The risk level can also be selected depending on the source device or the target device. For example, if the target device is a display device for presenting information, a low risk level can be selected. However, if the target device is an actuator used to operate an automated or autonomous vehicle, a high risk level can be selected.

[0024] Similarly, different requirements for the required hardware resources can be determined. For particularly large data packets or extensive rule sets, for example, it may be necessary to use a network device for filtering the data packets that has a particularly large amount of memory on a computer-readable storage medium. In particular, this is a content addressable memory, also known as TCAM.

[0025] Similarly, different requirements are placed on the required CPU performance. For example, processing particularly large data packets requires high CPU performance in order to process the data packet in a reasonable amount of time. Smaller data packets require correspondingly lower CPU performance. "CPU performance" refers to the execution speed of a processor or execution unit of a particular network device, defined, for example, by a clock rate, the number of floating-point operations per second (FLOPS), or the like.

[0026] A further advantageous embodiment of the network system according to the invention further provides that the firewall allocation unit is further configured to check the risk level, required hardware resources, and required CPU performance in a staggered manner according to their relevance, with the risk level having the highest relevance and the CPU performance having the lowest relevance. Particularly if multiple network devices in the direct network path from the source device to the destination device generally meet the processing requirement, this allows for a more refined selection of the final network device to be determined. Thus, specific thresholds can be set for the risk level, the hardware resources, and the CPU performance, which must at least be met. The greater the distance from these thresholds, the "better" a particular network device fulfills the processing requirement, i.e., the "better" its processing capabilities.The network device with the best processing capability is then selected, focusing particularly on the risk level, followed by the hardware resources and finally the CPU performance.

[0027] According to a further advantageous embodiment of the network system according to the invention, the firewall allocation unit is further configured to determine the order in which the processing capabilities of the network devices are compared with the processing requirements in accordance with the arrangement sequence of the network devices in the direct network path from the source device to the destination device when comparing the processing requirements with the processing capabilities. This further increases the efficiency of the network system according to the invention. The processing capability of each of the network devices in the direct network path does not necessarily have to be determined. An iterative approach can be used so that the processing capabilities of the network devices are gradually determined and checked according to the arrangement sequence.Once a first network device has been identified that generally meets the processing requirements, it can be designated to filter the data packets. The "best" network device, or firewall functionality, is then the network device located as far forward as possible in the direct network path and that first meets the processing requirements. This ensures that network devices located early in the direct network path are assigned the task of filtering the data packets. This prevents data packets that are later discarded by filtering from being forwarded through the network for longer, thus reducing network load.

[0028] A further advantageous embodiment of the network system according to the invention further provides that the firewall allocation unit is further configured to, if no suitable network device is found in a first run: - to perform further passes until a network device is found in the direct network path from the source device to the destination device whose processing capability meets the processing requirement; or - To determine the processing capabilities of network devices located away from the direct network path from the source device to the destination device, to compare these with the processing requirements and, if met, to determine a network device located away from the direct network path to filter the data packets.

[0029] If the first run of comparing the processing requirements with the processing capabilities of the network devices in the direct network path fails to find a suitable network device that meets the processing requirements, the question arises as to how to proceed so that the data packets can still be sent over the network's data line. Generally, it is possible that the firewall allocation unit selects a network device that does not meet the processing requirements to filter the data packets. In such a case, this can lead to the respective network device operating in an overloaded mode. The latency for forwarding the data packets increases accordingly.

[0030] Advantageously, the firewall allocation unit waits until one of the network devices in the direct network path fulfills the processing requirement. This means that the individual network devices can be fully utilized due to their tasks. As soon as one of the network devices has completed one or more tasks, such as forwarding and / or filtering other data packets, additional resources of that network device are available to filter the data packets from the source device to the destination device. Accordingly, the processing requirement can be fulfilled at a later time. This does increase latency, as it is necessary to wait until a suitable network device has free capacity to filter the data packets. However, the resulting increase in latency can be less than the increase in latency associated with determining an already fully utilized network device to filter the data packets.

[0031] If no suitable network device can be found along the direct network path within a reasonable amount of time, the firewall allocation unit can also select a network device located away from the direct network path to filter the data packets and redirect the data packets from the source device to the destination device over the network. While this reduces efficiency due to the redirection of the data packets, it can potentially reduce the time required to forward the data packets to the destination device, compared to having to wait a disproportionately long time for a network device with sufficient free computing resources on the direct network path.

[0032] The firewall allocation unit preferably determines such a network device away from the direct network path, which has a particularly short distance to the direct network path, so that the data packets are redirected as quickly as possible.

[0033] The respective network devices are preferably designed as Ethernet switches. These are particularly established, reliable, and widely used network devices, so that the network system according to the invention can be implemented simply and cost-effectively. A switch has Ethernet sockets or ports as a network connection. The communicating devices are connected to the switches via Ethernet cables. As already mentioned, the topology of the network system according to the invention can be arbitrary and, for example, can be implemented as: ring, mesh, star, fully connected, line, tree, bus, and the like.

[0034] At least the communicating devices have a unique identifier. This identifier can define the address of the respective device in the network system. When using Ethernet switches as network devices, this identifier is particularly the MAC address. Depending on which layer of the OSI model the respective switch operates on, the switches themselves may also have a MAC address.

[0035] The operation of a switch for forwarding data packets, also known as routes, based on so-called source address tables (SAT) is well known to the expert.

[0036] A vehicle according to the invention comprises such a network system as described above. The vehicle can be any vehicle, such as a car, truck, van, bus, or the like. Generally, it could also be a rail vehicle, watercraft, or aircraft.

[0037] Preferably, at least one communicating device is formed by a microcontroller, a microprocessor, a vehicle control unit, an actuator, or a sensor. This enables efficient and secure data traffic via a network system integrated into a vehicle. A respective vehicle control unit can itself be formed by a so-called system-on-a-chip, i.e., be implemented as a microcontroller or microprocessor itself, or include such components.

[0038] Further advantageous embodiments of the network system according to the invention also emerge from the exemplary embodiments which are described in more detail below with reference to the figures.

[0039] Showing: Fig. 1 a schematic representation of a network system according to the invention; Fig. 2 a schematic representation of a direct network path from a source device to a destination device in the network system; and Fig. 3 a flowchart of a possible embodiment of a method for filtering data packets by means of a firewall functionality that can be provided by the network system according to the invention.

[0040] Fig. 1 shows a network system 1 according to the invention. This comprises at least two network devices 2 and for each network device 2 at least one communicating device 3. The Fig. The topology of the network system 1 shown in Figure 1 is purely exemplary. All common network topologies are possible, such as ring-shaped, star-shaped, linear topologies, and the like. The network devices 2 are, in particular, Ethernet switches. The communication lines 5 between the network devices 2 and the communicating devices 3 connected to them are then formed by Ethernet cables. The Ethernet cables are connected to respective network connections (not shown). Such a network connection is also referred to as a port.

[0041] Furthermore, the network system 1 according to the invention comprises a firewall allocation unit (not shown in detail). The firewall allocation unit has not been shown since it can generally be integrated at any location in the network system 1 according to the invention. The firewall allocation unit can be connected to at least one network device 2 in the network system 1. In particular, the firewall allocation unit can be connected to several or even all network devices 2. The firewall allocation unit monitors the network devices 2 and, depending on a monitoring result, determines Fig. 2 shown source device 3.Q to a destination device 3.Z to transmit data packets of one of the network devices 2 for filtering the data packets.

[0042] For this purpose, the respective network devices 2 each have a firewall module 6 for providing firewall functionality. Such a firewall allows the application of predefined rules for filtering data packets. Depending on the firewall settings, the respective network devices 2 allow a subset of data packets to pass through for forwarding and discard the remaining data packets. All data packets can also be allowed through or discarded.

[0043] The respective firewall module 6 comprises program code, the execution of which by an execution unit included in the respective network device 2, such as a processor, allows the provision of the firewall functionality. Corresponding code modules can be stored together with other program code elements in a physical storage medium of the network device 2. Dedicated storage media can also be included in the network device 2 to store the program code components required to implement the firewall functionality. Other or dedicated execution units can also be used to execute the program code modules.

[0044] The network system 1 may have any number of more than two network devices 2, which is indicated by multiple dots "...".

[0045] Fig. 2 shows a direct network path 4 from the source device 3.Q to the destination device 3.Z. Any number of network devices 2 can be in the direct network path 4, but at least one network device 2. In the Fig. In the embodiment shown in Figure 2, the direct network path 4 contains the network devices 2.A, 2.B, and 2.X, or optionally additional network devices 2, indicated by dots "...". The respective network devices 2.A, 2.B, 2.X and the source device 3.Q and the destination device 3.Z are connected via double arrows, which is intended to indicate bidirectional communication. In general, the communication can also be unidirectional.

[0046] By default, each of the network devices 2.A, 2.B, and 2.X would apply the firewall functionality provided by the respective firewall module 6 to filter the data packets transmitted from the source device 3.Q to the destination device 3.Z. This represents unnecessary redundancy. Filtering the data packets multiple times is unnecessary and increases the latency in data forwarding, as well as blocking the computing resources of the respective network devices 2, preventing them from being used to process other tasks.

[0047] According to the invention, the firewall allocation unit determines one of the network devices 2.A, 2B or 2.X to apply the filter logic. Fig. In the embodiment shown in Figure 2, the network device 2.A is selected for this purpose, so that the remaining network devices 2.B and 2.X allow the respective data packets to pass through unfiltered to the destination device 3.Z.

[0048] To do this, the firewall allocation unit determines a processing requirement for data packets to be forwarded and, by monitoring the network devices 2, determines a network-device-specific processing capability for the network devices 2.A, 2.B, and 2.X integrated in the direct network path 4. It compares the processing requirement with the processing capabilities. The firewall allocation unit then selects a network device 2.A for filtering the data packets whose processing capabilities meet the processing requirement.

[0049] Fig. Figure 3 shows a possible and preferred embodiment of a method sequence. The components comprised by the network system 1 according to the invention are configured to execute method steps. The methods provided by these method steps are also part of the invention.

[0050] In method step 301, the firewall allocation unit determines the respective processing requirements of the data packets to be forwarded.

[0051] In step 302, the firewall allocation unit determines the processing functionality that can be provided by the first network device 2 located in the direct network path 4—here, network device 2.A—and compares the processing requirement with the respective processing capability. This occurs in method step 303.

[0052] If the processing capability meets the processing requirement, the firewall allocation unit selects network device 2.A to filter the data packets in method step 304. If, however, the condition is not met, the firewall allocation unit proceeds with the next network devices 2.B and 2.X located in the direct network path 4 and determines the processing capabilities accordingly, checking them against the processing requirement. In method step 305, the firewall allocation unit determines the respective processing capabilities. In method step 306, the processing requirement is compared with the respective processing capability. As soon as the processing requirement is met, the method ends in method step 307, also with the selection of the respective network device 2.B or 2.X and the corresponding application of the filter logic to the data packets.Otherwise, the firewall allocation unit can wait until the computing resources of one of the network devices 2.A, 2.B, 2.X are sufficient to meet the processing requirement. To do so, the firewall allocation unit can return to method step 302, as indicated by a dashed arrow.

Claims

[1] A network system (1) comprising at least two network devices (2) and at least one communicating device (3) for each network device (2), wherein the communicating devices (3) are each connected to one of the network devices (2) and a respective network device (2) is connected to at least one further network device (2) in order to enable an indirect exchange of data packets between communicating devices (3) via the network devices (2), wherein the respective network devices (2) have an integrated firewall functionality for filtering data packets to be forwarded, further comprising a firewall allocation unit, wherein the firewall allocation unit is configured to monitor the network devices (2) and, depending on a monitoring result for data packets to be transmitted from a source device (3.Q) to a destination device (3.Z), to determine one of the network devices (2) for filtering the data packets, characterized bythat the firewall allocation unit is further configured to determine a processing requirement for the data packets output by the source device (3.Q), to determine a network device-specific processing capability by monitoring the network devices (2) for the network devices (2.A, 2.B, 2.X) integrated in the direct network path (4) from the source device (3.Q) to the destination device (3.Z), to compare the processing requirement with the processing capabilities and to determine such a network device (2.A) for filtering the data packets whose processing capabilities meet the processing requirement. [2] Network system (1) according to claim 1, characterized by that the firewall assignment unit is further configured to configure the firewall functionalities of the network devices (2.A, 2.B, 2.X) integrated in the direct network path (4) from the source device (3.Q) to the destination device (3.Z) by assigning rule sets as follows: - Activating a filter logic of the firewall functionality of the network device intended to filter the data packets (2.A); and - Deactivating the filter logic of the firewall functionalities of the other network devices (2.B, 2.X). [3] Network system (1) according to claim 1 or 2, characterized by that the processing requirement and the respective processing capabilities include a risk level, required hardware resources and / or required CPU power. [4] Network system (1) according to claim 3, characterized by that the firewall allocation unit is further configured to check the risk level, required hardware resources and required CPU performance according to their relevance, with the risk level having the highest relevance and the CPU performance having the lowest relevance. [5] Network system (1) according to one of claims 1 to 4, characterized bythat the firewall allocation unit is further configured to determine, for the comparison of the processing requirement with the processing capabilities, the order in which the processing capabilities of the network devices (2.A, 2.B, 2.X) are compared with the processing requirement, in accordance with the arrangement order of the network devices (2.A, 2.B, 2.X) in the direct network path (4) from the source device (3.Q) to the destination device (3.Z). [6] Network system (1) according to claim 5, characterized by that the firewall allocation unit is also set up to, should no suitable network device (2) be found in a first run: - To perform further passes until a network device (2.A, 2.B, 2.X) is found in the direct network path (4) from the source device (3.Q) to the destination device (3.Z) whose processing capability meets the processing requirement; or - to determine the processing capabilities of network devices (2) located away from the direct network path (4) from the source device (3.Q) to the destination device (3.Z), to compare these with the processing requirement and, if fulfilled, to determine a network device (2) located away from the direct network path (4) for filtering the data packets. [7] Network system (1) according to one of claims 1 to 6, characterized by that the respective network devices (2) are designed as Ethernet switches. [8] Vehicle, characterized by a network system (1) according to one of claims 1 to 7. [9] Vehicle according to claim 8, characterized by that at least one communicating device (3) is formed by: a microcontroller, a microprocessor, a vehicle control unit, an actuator or a sensor.

Images